Back to overview

CVE-2026-63280

Description
Conditions administration did not consistently enforce tokens and component/mapped-item permissions.

Metadata

CVE ID
CVE-2026-63280
State
PUBLISHED
Assigner
Joomla
Reserved
2026-07-16 08:19 UTC
Published
2026-07-22 20:43 UTC
Last updated
2026-07-22 20:43 UTC
Primary CWE
CWE-352
CWE-352 Cross-Site Request Forgery (CSRF)
Vendor / Product
regularlabs.com / Advanced Module Manager extension for Joomla
Sources
cve.org  ·  NVD

Severity & Metrics

No CVSS data available.

Affected products (4)
VendorProductPlatformVersions
regularlabs.com Advanced Module Manager extension for Joomla — 1.0.0-11.0.1
regularlabs.com Conditional Content extension for Joomla — 1.0.0-6.0.0
regularlabs.com Content Templater Pro extension for Joomla — 1.0.0-13.0.0
regularlabs.com ReReplacer extension Pro for Joomla — 1.0.0-15.0.3
Weakness (CWE)
CWESourceDescription
CWE-284 cna CWE-284 Improper Access Control
CWE-352 cna CWE-352 Cross-Site Request Forgery (CSRF)
References (1)
Back to overview